Autopsy User's Guide

Overview

This is the User's Guide for the open source Autopsy platform. Autopsy allows you to examine a hard drive or mobile device and recover evidence from it. This guide should help you with using Autopsy. The developer's guide will help you develop your own Autopsy modules.

Autopsy 4 (and 3) are a complete rewrite from Autopsy 2, and none of this document is relevant to Autopsy 2.

Help Topics

The following topics are available here:

• Installing Autopsy
• Quick Start Guide
• Autopsy Workflow
• Cases and Adding Data Sources
  • Cases
  • Data Sources
  • UI Layout
• Automated Analysis (Modules)
  • Ingest Modules
  • Recent Activity Module
  • Hash Lookup Module
  • File Type Identification Module
  • Embedded File Extraction Module
  • EXIF Parser Module
  • Keyword Search Module
  • Email Parser Module
  • Extension Mismatch Detector Module
  • Data Source Integrity Module
  • Android Analyzer Module
  • Interesting Files Identifier Module
  • PhotoRec Carver Module
  • Correlation Engine Module
  • Encryption Detection Module
  • Virtual Machine Extractor Module
• Manual Analysis
  • Tree Viewer
  • Result Viewer
  • Content Viewer
  • UI Quick Search
  • Image Gallery Module
  • File Search
  • Ad Hoc Keyword Search
  • Timeline
  • STIX
  • Central Repository
  • Communications Visualization Tool
  • Common Properties Search
  • Search All Cases
  • Logs, Output, and Progress
• Reporting
  • Tagging
  • Reporting
• Installing 3rd-Party Modules
• Optimizing Performance
• Multi-user Collaborative Deployments
  • Setting Up Multi-user Environment
    • Install and Configure ActiveMQ
    • Install and Configure PostgreSQL
    • Install and Configure Solr
    • Shared Drive Authentication
  • Multi-user Case Security
  • Using Multi-user Cases
• Live Triage
• Advanced Settings
• Experimental Module

If the topic you need is not listed, refer to the Autopsy Wiki or join the SleuthKit User List at SourceForge.